Patch Tuesday: CVE-2017-11826 Microsoft Office

There is an in-the-wild exploit for Microsoft Office. A patch has been released. This exploit has turned up on Virtus Total today.

A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.

Patch Tuesday: KB4041691 & KB4041676 gona ruin your day

Microsoft has made a bit of a boo-boo this week. Hopefully, you haven’t auto approved patches this week.

KB4041691 and KB4041676 were pushed as delta updates through WSUS. First published on Twitter, but now there is a Reddit thread on the issue https://www.reddit.com/r/sysadmin/comments/75o0oq/windows_security_updates_broke_30_of_our_machines/

If you run into this issue, you will need to boot into WinRE and use DISM to remove the update.

With all updates from Microsoft lately, I recommend you lab them first. Don’t take the risk.

User Device Registration Event ID 304 307

With Server 2016, we’ve been getting a lot of these errors in the event log

This is caused by a task called Automatic-Device-Join which runs as a scheduled task whenever someone logs into a server (terminal server). This can cause a lot of events on the system.

Disable this task. This is used for Azure AD device joins. No idea why this is enabled by default.

OfficeBackgroundTaskHandlerRegistration Flashes a black CMD window every hour

This is an annoying issue I’ve been trying to find the answer to for a couple of days.

I get a quick flash on my screen with a black box which looks like a command window. I finally had this happen on a slow enough computer where I could see where it was running from. See below.

To fix this issue, do the following:

  1. Open task scheduler from the start menu
  2. Find Microsoft Office under tasks
  3. Disable OfficeBackgroundTaskHandlerRegistration

A fix from Microsoft on this issue is underway.

Veeam cannot see ReFS 3.1 volumes in backup (Server 2012 R2)

We had a problem recent where Veeam 9.5 which was installed on Windows 2012 R2 trying to restore from Exchange 2016 on Server 2016 with ReFS datastores.

It turns out, Server 2012 R2 cannot recognise ReFS 3.1 which is on Server 2016. From the screenshot below, this backup is missing two drives which are ReFS:

When logging in to the Exchange server, you will see the correct drives

To fix this you really only have one option: Install Veeam B&R on Server 2016, or at the bare minimum, the mount points on Server 2016.

Once you have a Server 2016 mount point, you will be able to see the ReFS drives.

Method ‘Upgrade’ in type ‘Microsoft.SharePoint.WorkflowServices.WorkflowServiceApplicationProxy’ Sharepoint 2013 pre SP1

We have an old install of Sharepoint 2013 which has the March 2013 PU installed. A bunch of security updates slipped through which patched Sharepoint. You will get the following error:

Method 'Upgrade' in type 'Microsoft.SharePoint.WorkflowServices.WorkflowServiceApplicationProxy' from assembly 'Microsoft.SharePoint.WorkflowServices, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c' does not have an implementation.

This is apparently caused by newer security updates shipping with Sharepoint 2013 SP1 dll files. In order to fix this issue, download and install KB2880963. The install may take some time.

ERR_SPDY_INADEQUATE_TRANSPORT_SECURITY Server 2016/Exchange 2016

Over the weekend I’ve been installing Microsoft Server 2016 with Exchange 2016 on top. Once my SSL certificates were loaded, I got the following error when accessing OWA

ERR_SPDY_INADEQUATE_TRANSPORT_SECURITY

I’ve seen this before on Apache. However, I was amused that this was an issue with Server 2016 since I thought that Microsoft would have disabled the Cipher suites used which cause this error. Apparently not.

A brute-force way to quickly fix this is to disable SPDY. To do this, open up the following registry key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Http\Paramaters

Add the following two dword keys

EnableHttp2Cleartext 0
EnableHttp2Tls 0

It should look like the following

vmware_2016-10-30_17-00-25

You can likely disable your offending cipher suites by following these guidelines.

Update 1: I solved my issue by disabling SHA and MD5 hashes on the Exchange server using IISCrypto. See below:

IIS Crypto

Veeam Backup Fails: VSS Writer Errror 0x800423f4 (Azure AD Connect)

Hi Guys.

An interesting issue over the last few days. Our backup logs have had the following failures in Veeam.

Unable to release guest. Error: Unfreeze error (over VIX): [Backup job failed. Cannot create a shadow copy of the volumes containing writer's data. A VSS critical writer has failed. Writer name: [SqlServerWriter]. Class ID: [{a65faa63-5ea8-4ebc-9dbd-a0c4db26912a}]. Instance ID: [{6323fe10-0205-47df-b015-4a5ff60c31e2}]. Writer's state: [VSS_WS_FAILED_AT_PREPARE_SNAPSHOT]. Error code: [0x800423f4].]
Error: Unfreeze error (over VIX): [Backup job failed. Cannot create a shadow copy of the volumes containing writer's data. A VSS critical writer has failed. Writer name: [SqlServerWriter]. Class ID: [{a65faa63-5ea8-4ebc-9dbd-a0c4db26912a}]. Instance ID: [{6323fe10-0205-47df-b015-4a5ff60c31e2}]. Writer's state: [VSS_WS_FAILED_AT_PREPARE_SNAPSHOT]. Error code: [0x800423f4].]

Digging through the event logs, you will see errors like the following:

  1. Inital backup
    SQLVDI: Loc=SignalAbort. Desc=Client initiates abort. ErrorCode=(0). Process=19908. Thread=18488. Client. Instance=LOCALDB#SH7A2278. VD=Global\{C7140958-2759-4979-BA55-0E3F258064ED}1_SQLVDIMemoryName_0.

    vpxclient_2016-09-08_13-09-55

  2. Followed by
    A VSS writer has rejected an event with error 0x800423f4, The writer experienced a non-transient error. If the backup process is retried,
    the error is likely to reoccur.
    . Changes that the writer made to the writer components while handling the event will not be available to the requester. Check the event log for related events from the application hosting the VSS writer. 
    
    Operation:
     PrepareForSnapshot Event
    
    Context:
     Execution Context: Writer
     Writer Class Id: {a65faa63-5ea8-4ebc-9dbd-a0c4db26912a}
     Writer Name: SqlServerWriter
     Writer Instance Name: SQL Server Code-Named 'Denali' CTP2:SQLWriter
     Writer Instance ID: {2f97c809-8eb4-431c-93ac-b0f81e610013}
     Command Line: "C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
     Process ID: 19908

    mstsc_2016-09-08_13-17-47

    mstsc_2016-09-08_13-18-02

We have found this issue is related to an update of the Microsoft Azure AD Connect client.

On all servers that were affected by this, we had just upgraded to the latest Azure AD Connect client. This seems to corrupt the SQL writer somehow.

We haven’t seen many reports of this. There are various fixes for the 0x800423f4 error, but the easiest fix is to repair the LocalDB SQL instance.

To do this:

  1. Go to Add/Remove Programs
  2. Select Microsoft SQL Server 2012 Express LocalDB
  3. Select Repair
    vpxclient_2016-09-08_13-11-17

Once this is finished, you will need to reboot.

We had this issue with many servers. This process fixed it on everyone.

Microsoft removes features from Windows 10 Professional

Earlier in the month Microsoft announced their new subscription service for Windows 10 Enterprise. Starting at just $7 USD per month, end users are able to subscribe to Windows 10 enterprise on a monthly basis.

This, I  think, is a good move by Microsoft.

However, what is disturbing is what Microsoft is changing on lower tier versions, such as Windows 10 Professional. See the following changes:

Windows 10 changes

I’d say this is to target the small business users who now cannot disable the shop within Windows. This will push slightly larger businesses to go to Enterprise.

While a small change, I hope Microsoft doesn’t fall into the trap many other monthly subscription providers have fallen into.

See the following for more information.